<?php
 include "counter.php";
?>
<?php pagehead("Malus status") ?>
<BODY bgcolor="white">
<?php pagetop() ?>
<h1><img src="../gifs/Logo-small.png">
Malus status</h1>
This page shows which IP addresses have currently made an excessive
 number of calls to the "display-person" page (or other pages
 protected by the malus mechanism).
<p>
If too many spiders index the counter, the result can be seen on the
<a href="/server-status">server-status</a> page.
<p>
<table border>
<tr><th>Function<th>IP<th>Count<th>Last seen
<?php
   $malus = mysql_query("select *,
          date > date_sub(now(), interval 1 day) as new,
	  date > date_sub(now(), interval 1 hour) as now
           from malus where count > 20 and func <> 'ua'
	  order by count desc, caller desc");  
   
       while ( $mal = mysql_fetch_array($malus)) {
	    # check for substantially similar entries
	    $prevcaller = preg_replace("/\d+.\*$/", "*", $prevcaller); # previous star
	    $prevcaller = preg_replace("/\d+$/", "*", $prevcaller); # no star
	    if ($mal[count] == $prevcount && $mal[func] == $prevfunc
	        && $mal[caller] == $prevcaller) {
	        continue;
            }
	    $prevcaller = $mal[caller];
	    $prevfunc = $mal[func];
	    $prevcount = $mal[count];

            print("<tr><td>" . $mal[func] . "<td>" . $mal[caller]
            . "<td>" . $mal[count]);
	    if ($mal["now"]) {
	       print("<td bgcolor=\"red\">" . $mal[date] . "\n");
	    } else if ($mal["new"]) {
	       print("<td bgcolor=\"pink\">" . $mal[date] . "\n");
            } else {
	       print("<td>" . $mal[date] . "\n");
            }
        }
?>
</table>
<h2>Notes</h2>

Slowdown functions will kick in if the count passes 25; the scripts
 will return useless results if the count passes 50.
<p>
The entries marked in pink have seen
activity in the last 24 hours. 
<p>
"Net" entries are only considered when hardcoded; they are reported
 here to give warning when someone scans from multiple sites in a
 subnet. It has happened.
<p>
The counts are reduced by 10 every night - those who go slightly over
 should get forgiveness after a while.

<?php pagebottom() ?>
</body>
</html>


